cleaning up failed: nearlyfreespeech: The API request was not valid.

[jhfry]

It appears that the DNS challenge passed ("Found CNAME entry"), but failed on the cleanup ("cleaning up failed").

I checked my DNS records, and don't see any orphaned acme entries, so I suspect the cleanup worked but plugin still saw it as a failure?

Any suggestions?

2024/01/10 22:51:11 [INFO] [lab.thefrys.com, *.lab.thefrys.com] acme: Obtaining bundled SAN certificate
2024/01/10 22:51:11 [INFO] [*.lab.thefrys.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/302863783336
2024/01/10 22:51:11 [INFO] [lab.thefrys.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/302863783346
2024/01/10 22:51:11 [INFO] [*.lab.thefrys.com] acme: use dns-01 solver
2024/01/10 22:51:11 [INFO] [lab.thefrys.com] acme: Could not find solver for: tls-alpn-01
2024/01/10 22:51:11 [INFO] [lab.thefrys.com] acme: Could not find solver for: http-01
2024/01/10 22:51:11 [INFO] [lab.thefrys.com] acme: use dns-01 solver
2024/01/10 22:51:11 [INFO] [*.lab.thefrys.com] acme: Preparing to solve DNS-01
2024/01/10 22:51:12 [INFO] Found CNAME entry for "_acme-challenge.lab.thefrys.com.": "thefrys.duckdns.org."
2024/01/10 22:51:12 [INFO] [*.lab.thefrys.com] acme: Cleaning DNS-01 challenge
2024/01/10 22:51:12 [INFO] Found CNAME entry for "_acme-challenge.lab.thefrys.com.": "thefrys.duckdns.org."
2024/01/10 22:51:12 [WARN] [*.lab.thefrys.com] acme: cleaning up failed: nearlyfreespeech: The API request was not valid.: The requested object instance does not exist or cannot be accessed. 
2024/01/10 22:51:12 [INFO] [lab.thefrys.com] acme: Preparing to solve DNS-01
2024/01/10 22:51:12 [INFO] Found CNAME entry for "_acme-challenge.lab.thefrys.com.": "thefrys.duckdns.org."
2024/01/10 22:51:12 [INFO] [lab.thefrys.com] acme: Cleaning DNS-01 challenge
2024/01/10 22:51:12 [INFO] Found CNAME entry for "_acme-challenge.lab.thefrys.com.": "thefrys.duckdns.org."
2024/01/10 22:51:12 [WARN] [lab.thefrys.com] acme: cleaning up failed: nearlyfreespeech: The API request was not valid.: The requested object instance does not exist or cannot be accessed. 
2024/01/10 22:51:12 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/302863783336
2024/01/10 22:51:12 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/302863783346
2024/01/10 22:51:13 Could not obtain certificates:
        error: one or more domains had a problem:
[*.lab.thefrys.com] [*.lab.thefrys.com] acme: error presenting token: nearlyfreespeech: The API request was not valid.: The requested object instance does not exist or cannot be accessed.
[lab.thefrys.com] [lab.thefrys.com] acme: error presenting token: nearlyfreespeech: The API request was not valid.: The requested object instance does not exist or cannot be accessed.

[jhfry]

I tried doing it with an A record rather than a cname record and got the same error, but it was successful:

2024/01/10 23:30:35 [INFO] [vpn.thefrys.com] acme: Obtaining bundled SAN certificate
2024/01/10 23:30:36 [INFO] [vpn.thefrys.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/302874136576
2024/01/10 23:30:36 [INFO] [vpn.thefrys.com] acme: Could not find solver for: tls-alpn-01
2024/01/10 23:30:36 [INFO] [vpn.thefrys.com] acme: Could not find solver for: http-01
2024/01/10 23:30:36 [INFO] [vpn.thefrys.com] acme: use dns-01 solver
2024/01/10 23:30:36 [INFO] [vpn.thefrys.com] acme: Preparing to solve DNS-01
2024/01/10 23:30:36 [INFO] [vpn.thefrys.com] acme: Trying to solve DNS-01
2024/01/10 23:30:36 [INFO] [vpn.thefrys.com] acme: Checking DNS record propagation using [192.168.66.1:53]
2024/01/10 23:30:38 [INFO] Wait for propagation [timeout: 1m0s, interval: 2s]
2024/01/10 23:30:45 [INFO] [vpn.thefrys.com] The server validated our request
2024/01/10 23:30:45 [INFO] [vpn.thefrys.com] acme: Cleaning DNS-01 challenge
2024/01/10 23:30:45 [WARN] [vpn.thefrys.com] acme: cleaning up failed: nearlyfreespeech: The API request was not valid.: The requested object instance does not exist or cannot be accessed. 
2024/01/10 23:30:45 [INFO] [vpn.thefrys.com] acme: Validations succeeded; requesting certificates
2024/01/10 23:30:45 [INFO] [vpn.thefrys.com] Server responded with a certificate.

This suggests to me that maybe it has a problem with CNAME, but doesn't actually throw that error? Seems really strange to me that the only error I see was during the cleanup, but on an A record it's successful, and on CNAME it fails. Also, I don't see any "Found..." entries in the successful output.

Are A records required?

[jhfry]

Did some more digging and found LEGO_DISABLE_CNAME_SUPPORT=true, just caused it to time out after successfully writing the TXT records to my NearlyFreeSpeech domain. For some reason it seems to be checking the duckdns.org name servers rather than thefrys.com (following the CNAME) even when I said to disable CNAME support:

2024/01/10 23:50:08 Could not obtain certificates:
        error: one or more domains had a problem:
[*.lab.thefrys.com] propagation: time limit exceeded: last error: read udp 192.168.66.6:50578->99.79.143.35:53: read: connection refused
[lab.thefrys.com] propagation: time limit exceeded: last error: NS ns9.duckdns.org. did not return the expected TXT record [fqdn: thefrys.duckdns.org., value: thnB9vHiYIjwzumM59enSSkJYxdNO1744E1SRYVCwFY]:

To be clear, duckdns is simply a dynamic dns provider, I use it to resolve my home network's IP for VPN (mostly), I don't have any control over the records there.

Is there anything else I can try?

[jhfry]

Ok... I figured out how to make it work... didn't see anything anywhere that suggested this, but I took a stab in the dark and figured it out. Just in case anyone else runs into the same issue:

There are three possibilities with CNAMEs:

1. Certificate requester manages the CNAME targeted domain only
2. Certificate requester manages the the requested domain only
3. Certificate requester manages both.

If your in #1, like a web hosting provider, LEGO just works as expected. You target the requested domain, the CNAME resolves to your name servers and it adds the necessary TXT records and validates them there.

If your in #2, like I am, it's not so easy. You need to add an extra CNAME for the (sub)domain that you are requesting a certificate for... in my case "_acme-challenge.lab.thefrys.com". This needs to point to any other (sub)domain that you control. I used "challenge.thefrys.com" for which I created an A record that pointed to 1.1.1.1, though I'm not even sure an A record was necessary.

#3 can use either of the above methods.

Hope this helps someone!